Gitweb links: ...log http://git.netsurf-browser.org/libnsgif.git/shortlog/f9b8f113aa8a51ef4a70... ...commit http://git.netsurf-browser.org/libnsgif.git/commit/f9b8f113aa8a51ef4a704c... ...tree http://git.netsurf-browser.org/libnsgif.git/tree/f9b8f113aa8a51ef4a704c12... The branch, master has been updated via f9b8f113aa8a51ef4a704c129a7e939800efdbc5 (commit) from 0aeb0afe342d035ab32bac1d89b185f25d7acf32 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commitdiff http://git.netsurf-browser.org/libnsgif.git/commit/?id=f9b8f113aa8a51ef4a... commit f9b8f113aa8a51ef4a704c129a7e939800efdbc5 Author: Michael Drake <tlsa(a)netsurf-browser.org&gt; Commit: Michael Drake <tlsa(a)netsurf-browser.org&gt; lzw: Detect invalid code after clear code. diff --git a/src/lzw.c b/src/lzw.c index 4b521b6..dd30d01 100644 --- a/src/lzw.c +++ b/src/lzw.c @@ -347,8 +347,12 @@ static inline lzw_result lzw__decode(struct lzw_ctx *ctx, } else if (code == ctx->clear_code) { lzw__clear_table(ctx); } else { - if (ctx->prev_code != ctx->clear_code && - ctx->table_size < LZW_TABLE_ENTRY_MAX) { + if (ctx->prev_code == ctx->clear_code) { + if (code > ctx->clear_code) { + return LZW_BAD_ICODE; + } + + } else if (ctx->table_size < LZW_TABLE_ENTRY_MAX) { uint32_t size = ctx->table_size; lzw__table_add_entry(ctx, (code < size) ? ctx->table[code].first : ----------------------------------------------------------------------- Summary of changes: src/lzw.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/lzw.c b/src/lzw.c index 4b521b6..dd30d01 100644 --- a/src/lzw.c +++ b/src/lzw.c @@ -347,8 +347,12 @@ static inline lzw_result lzw__decode(struct lzw_ctx *ctx, } else if (code == ctx->clear_code) { lzw__clear_table(ctx); } else { - if (ctx->prev_code != ctx->clear_code && - ctx->table_size < LZW_TABLE_ENTRY_MAX) { + if (ctx->prev_code == ctx->clear_code) { + if (code > ctx->clear_code) { + return LZW_BAD_ICODE; + } + + } else if (ctx->table_size < LZW_TABLE_ENTRY_MAX) { uint32_t size = ctx->table_size; lzw__table_add_entry(ctx, (code < size) ? ctx->table[code].first : -- NetSurf GIF Decoder